From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04C6DC04A94 for ; Fri, 11 Aug 2023 15:09:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235484AbjHKPJn (ORCPT ); Fri, 11 Aug 2023 11:09:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41106 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235128AbjHKPJl (ORCPT ); Fri, 11 Aug 2023 11:09:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4B1CA19AE; Fri, 11 Aug 2023 08:09:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DCC7467439; Fri, 11 Aug 2023 15:09:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91028C433C8; Fri, 11 Aug 2023 15:09:35 +0000 (UTC) Date: Fri, 11 Aug 2023 16:09:33 +0100 From: Catalin Marinas To: Mark Brown Cc: Will Deacon , Jonathan Corbet , Andrew Morton , Marc Zyngier , Oliver Upton , James Morse , Suzuki K Poulose , Arnd Bergmann , Oleg Nesterov , Eric Biederman , Kees Cook , Shuah Khan , "Rick P. Edgecombe" , Deepak Gupta , Ard Biesheuvel , Szabolcs Nagy , "H.J. Lu" , Paul Walmsley , Palmer Dabbelt , Albert Ou , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, kvmarm@lists.linux.dev, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org Subject: Re: [PATCH v4 17/36] arm64/mm: Handle GCS data aborts Message-ID: References: <20230807-arm64-gcs-v4-0-68cfa37f9069@kernel.org> <20230807-arm64-gcs-v4-17-68cfa37f9069@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230807-arm64-gcs-v4-17-68cfa37f9069@kernel.org> Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org On Mon, Aug 07, 2023 at 11:00:22PM +0100, Mark Brown wrote: > @@ -510,6 +527,26 @@ static vm_fault_t __do_page_fault(struct mm_struct *mm, > */ > if (!(vma->vm_flags & vm_flags)) > return VM_FAULT_BADACCESS; > + > + if (vma->vm_flags & VM_SHADOW_STACK) { > + /* > + * Writes to a GCS must either be generated by a GCS > + * operation or be from EL1. > + */ > + if (is_write_abort(esr) && > + !(is_gcs_fault(esr) || is_el1_data_abort(esr))) > + return VM_FAULT_BADACCESS; Related to my PIE permissions comment: when do we have a valid EL1 data write abort that's not a GCS fault? Does a faulting GCSSTTR set the ESR_ELx_GCS bit? > + } else { > + /* > + * GCS faults should never happen for pages that are > + * not part of a GCS and the operation being attempted > + * can never succeed. > + */ > + if (is_gcs_fault(esr)) > + return VM_FAULT_BADACCESS; If one does a GCS push/store to a non-GCS page, do we get a GCS fault or something else? I couldn't figure out from the engineering spec. If the hardware doesn't generate such exceptions, we might as well remove this 'else' branch. But maybe it does generate a GCS-specific fault as you added a similar check in is_invalid_el0_gcs_access(). > @@ -595,6 +644,19 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr, > if (!vma) > goto lock_mmap; > > + /* > + * We get legitimate write faults for GCS pages from GCS > + * operations and from EL1 writes to EL0 pages but just plain What are the EL1 writes to the shadow stack? Would it not use copy_to_user_gcs()? -- Catalin